Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
  • H04N21/21—Server components or server architectures
  • H04N21/222—Secondary servers, e.g. proxy server, cable television Head-end
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
  • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
  • H04N21/234—Processing of video elementary streams, e.g. splicing of video streams or manipulating encoded video stream scene graphs
  • H04N21/2347—Processing of video elementary streams, e.g. splicing of video streams or manipulating encoded video stream scene graphs involving video stream encryption
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
  • H04N21/41—Structure of client; Structure of client peripherals
  • H04N21/418—External card to be used in combination with the client device, e.g. for conditional access
  • H04N21/4181—External card to be used in combination with the client device, e.g. for conditional access for conditional access
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
  • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
  • H04N21/647—Control signaling between network components and server or clients; Network processes for video distribution between server and clients, e.g. controlling the quality of the video stream, by dropping packets, protecting content from unauthorised alteration within the network, monitoring of network load, bridging between two different networks, e.g. between IP and wireless
  • H04N21/64784—Data processing by the network
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
  • H04N21/83—Generation or processing of protective or descriptive data associated with content; Content structuring
  • H04N21/835—Generation of protective data, e.g. certificates
  • H04N21/8358—Generation of protective data, e.g. certificates involving watermark
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
  • H04N21/21—Server components or server architectures
  • H04N21/226—Characteristics of the server or Internal components of the server
  • H04N21/2265—Server identification by a unique number or address, e.g. serial number
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
  • H04N21/61—Network physical structure; Signal processing
  • H04N21/6106—Network physical structure; Signal processing specially adapted to the downstream path of the transmission network
  • H04N21/6125—Network physical structure; Signal processing specially adapted to the downstream path of the transmission network involving transmission via Internet
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
  • H04N21/61—Network physical structure; Signal processing
  • H04N21/6156—Network physical structure; Signal processing specially adapted to the upstream path of the transmission network
  • H04N21/6175—Network physical structure; Signal processing specially adapted to the upstream path of the transmission network involving transmission via Internet

Definitions

• the present invention concerns the field of multimedia reception devices, in particular devices based on Ethernet communication layer for IP protocol and a method to access protected content by a multimedia reception device.
• the IP protocol is today widely used to distribute multimedia contents such as audio, video.
• Huge database are accessible on-line and allow to stream live or on-demand content. These contents are streamed using Internet communication protocol, in unicast or multicast mode.
• Document US7406598 rel ated to a method and system for secu re content distribution discloses a system on a chip (SOC) device comprising external outputs, and external inputs.
• a first secure storage location is operably decoupled from all of the external outputs of the SOC device during a normal mode of operation. By being decoupled from all external outputs, representations of the data stored at the first secure device are prevented from being provided to the external outputs.
• a decryption engine is also included on the system on a chip, comprising a first data input, and a private key input coupled to a first portion of the first secure storage location, and an output coupled to a second secure location.
• the decryption engine is operable to determine decrypted data from data received at the first data input based upon a private key received at the private key input.
• the decryption engine is further operable to write the decrypted data only to the first secure memory location and the second secure location.
• the system further comprises a descrambler having an output coupled to a watermark module operable to provide a watermark to image data from the output of the descrambler.
• the present invention aims to address the issue of deploying costly hardware by proposing a content protection layer with an easy distribution capability to clients.
• an network device for descrambling an access controlled audio/video content stream said network device being configured to be connected to a network router is characterized in that it comprises:
• a watermark engine configured to watermark the descrambled audio/video content stream according to the unique address UA
• a further object of the invention is a method to access scrambled audio/video content stream via an IP network by using a multimedia reception device connected to a network router associated to a network device, said network device being identified by a unique address stored in a memory of said network device, the method comprising steps of:
• the scrambled audio/video content stream by using the obtained access right, - watermarking all or a part of the descrambled audio/video content stream in order to embed the unique address identifying the network device, so as to obtain a personalized descrambled audio/video content stream,
• the network device preferably in form of a removable hardware dongle comprises an Ethernet connection allowing plugging it into an appropriate Ethernet connector of the router.
• the dongle is in charge of communicating with a server, requesting the content desired by the user, providing its unique address UA, receiving the protected content, removing the protection , add ing the watermark and su pplying the watermarked content to the multimedia reception device via the Ethernet network.
• the dongle of the present invention has some features common to the system on chip of document US7406598, it is further adapted to solve the problem of live streaming of media content over Ethernet connection or IP port. Furthermore, the system on chip of document US7406598 is limited to be used for content distribution where external inputs and outputs are secured storage location.
• Figure 1 shows a block diagram of a local mode to access a content stream by a multimedia reception device connected to a network router associated to a network device.
• Figure 2 shows a block diagram of a roaming mode to access a content stream by a multimedia reception device connected to a network router associated to a network device.
• the network device D of the invention may be configured as a removable hardware dongle connected to one of the IP ports of a standard router RT which is an element of a user's network.
• the functions of the dongle may be summarized as follow:
• a first way is to descramble the content.
• the key for descrambling the content can be requested once within a predetermined period (e.g . a day) or in relation to each content stream.
• the dongle D should present its unique address UA, which is verified in a database of a conditional access system sever CAS or other server where the dongle is registered along with user identification. If the unique address UA is considered as valid by the CAS server, the descrambling key is sent to the dongle D. According to an embodiment, this key is sent in clear or may be encrypted by a personal key of the dongle D.
• the database of the CAS server contains for each UA, a personal key of the dongle D.
• the content itself is encrypted by the personal key of the dongle D.
• the encrypted content is dedicated only to a given dongle D.
• the initial content is corrupted by removing some data at particular places and the removed data (which represent a few percentage of the content) forms complementary information.
• the corrupted content is sent to all users using unicast or multicast mode, and the complementary information, encrypted for a particular dongle, is sent upon request of the dongle.
• the dongle D While the protection layer is removed, the dongle D adds a watermark to identify the dongle D which has removed the protection.
• Common techniques can be used such as developed by Civolution according to WO01 /28230.
• the dongle D provides an output that can be accessed by any device within the network. In case of connection to a router via a wireless protocol (Wireless Fidelity, WiFi) for example, a multimedia reception device MRD as a television set, receives the data packets of the content stream from the dongle D via the WiFi connection.
• a wireless protocol Wireless Fidelity, WiFi
• the multimedia reception device MRD may also comprise adaptive streaming feature as a feature of the dongle D (or the system): if the content is viewed on a low bandwidth network, the dongle D or the system will adapt the bandwidth of the streamed content by changing the resolution, the quality or the compression factor.
• the adaptive streaming may be performed according to following modes:
• a high throughput of the content stream entering the dongle D is automatically reduced by means of intermediate buffering and using a handshake mechanism.
• the resolution, the quality or the compression factor of the descrambled watermarked content stream are adapted to the network bandwidth performances.
• the content streaming through the dongle D is controlled and adapted to the network capabilities from the content provider to the multimedia reception device MRD.
• the dongle D may be configured to process several content streams in parallel.
• the dongle D can store several content descrambling keys at a time and is able to obtain two (or more) protected streams, remove by the descrambler the protection of the received streams, embed the watermark by the watermark engine and provide these descrambled watermarked streams to the multimedia reception device MRD connected to the network.
• the dongle will preferably be powered through PoE to avoid additional transformer.
• Another way to power and connect the dongle is through an Universal Serial Bus (USB) interface.
• USB Universal Serial Bus
• the host device network router RT
• the dongle D individually powered, may also use a wireless network connection such as WiFi or 3G / 4G with the network router RT.
• the dongle D may include an internal memory to store content or an external memory consisting of a memory card such as for example a MicroSD card or other standardized type of memory card.
• a memory card such as for example a MicroSD card or other standardized type of memory card.
• PVR Personal Video Recorder
• FIG. 1 illustrates a first mode to access locally a content stream by a multimedia reception device MRD such as a television set or a personal computer PC connected to a network router RT associated to a network device or dongle D.
• the content stream is made available on the IP network by one or several content providers (CP1 , CP2 , CP3) distributing scrambled audio/video content streams.
• Content may also be stored on a local or remote hard disk HD in a scrambled form and made available on the network.
• a conditional access system server CAS includes a database storing user identification data along with the unique address UA of the network device D which identifies it on the network. This unique address UA stored in a memory of the network device D allows obtaining scrambled streams on the network only if the user benefits from the appropriate access rights.
• a user selects a scrambled audio/video content stream on a l i st of scrambled audio/video content available on the network displayed via a user interface of the multimedia reception device MRD.
• the network device D finds a content provider server (CP1 , CP2, CP3) and the conditional access system server CAS by using a standard Domain Name System (DNS) protocol and sends appropriate requests to obtain the selected stream and the correspond ing access rights.
• DNS Domain Name System
• the u n iq u e add ress UA of the dong l e D allows obtaining the necessary access right from a conditional access server CAS of an operator providing access rights to scrambled content streams.
• the router RT is preferably configured for a dynamic IP address which changes at specific periods or at each session instead of a static IP address.
• the connection of the network device (dongle D) to the conditional access system server CAS is made secure by creating an encrypted VPN (Virtual Private Network) tunnel .
• VPN Virtual Private Network
• Each of the network router RT respectively the dongle D and the CAS server are authenticated mutually so that a global or unique key for descrambling a stream can be sent through the encrypted VPN tunnel from the CAS server to the network device D via the network router RT.
• the descrambling keys are generally sent in clear form in the encrypted VPN tunnel .
• the access rights may be acquired by a user either by impulse purchase (I PPV) Impulse Purchase per View of one or a set of content or by a subscription to one or more sets or categories of content.
• the received content is descrambled and watermarked by applying the unique address UA of the dongle D entirely or partially to save processing load and time.
• This watermarking prevents anonymous copies and distribution of the content to third parties over Internet for example.
• the content is thus personalized for a given network router RT acting as a source of content stream .
• the orig in of a copy can th us be identified and the corresponding dongle D may be blacklisted or rejected from the network.
• a second access mode il lustrated by figure 2 may be performed remotely by a remote multimedia reception device RMRD such as a smart phone, a tablet PC, a personal computer etc. or any user un it able to connect to a public network, i .e. Internet.
• This mode is also called roaming mode where the user connects to scrambled content streams whatever the location of the remote multimedia reception device RMRD in relation with the network router RT.
• ISP Internet Service Provider
• Th is address may either be static, or dynamic, i.e. it changes from one session on the Internet to the next. If it is necessary to be able to access a remote computer or other network device from another location, a static numeric address is inconvenient to remember; an address which changes unpredictably makes connection impossible.
• an IP address of the network router RT is determined by using a service called Dynamic DNS (Domain Name System) service (DDNS).
• DDNS Dynamic DNS (Domain Name System) service
• a DDNS provider allocates a static hostname to the user; whenever the user is allocated a new IP address this is communicated to the DDNS provider by software (implementing RFC 2136 protocol or other protocols) running on the network router RT equipped with the dongle D at that address.
• the DDNS provider distributes the association between the hostname and the address to an Internet D NS server so that DNS queries are resolved.
• the final result is that a roaming user may communicate with his network router at home, for example through a website "username.ddnsservice.org" instead of an unknown varying IP address.
• the host name is resolved to the current address of the network router RT at home with a DNS query transparent to the user.
• the communication between the dongle D via the network router RT and the DD NS provider is preferably secured by using protocols such as Transport Layer Security (TLS) or Secure Sockets Layer (SSL).
• TLS Transport Layer Security
• SSL Secure Sockets Layer
• the remote multimedia reception device RMRD uses the standard DNS servers from the Internet Service Provider (ISP) currently used at the remote location to resolve "username.ddnsservice.org" domain name.
• ISP Internet Service Provider
• the network device or dongle D updates automatically the IP address on a server of the DDNS provider.
• the I P address of the network router RT is regularly updated by a DDNS service to which it is linked.
• the network router RT is configured for port forwarding which points to the network device D when connection requests to the content provider server (CP1 , CP2, CP3) are carried out by remote multimedia reception devices RMRD.
• the port forwarding may be performed either through a static configuration or by using a protocol such as UPnP (Universal Plug and Play) where the network device tells the network router RT to open a port and to forward it to its internal IP address.
• UPnP Universal Plug and Play
• the remote multimedia reception device RMRD finds the network device D by using the DNS protocol and carries out steps of
• the l ist is retrieved either from the network device D or d irectly from a content provider server (CP1 , CP2, CP3) of the network.
• the network device D receives the list from the content provider server. - notifying by the remote multimedia reception device RMRD the network device D on the selected audio/video content stream,
• the network device D and the remote multimedia reception device RMRD create an encrypted VPN tunnel to transfer the personal ized descrambled audio/video content stream.
• This configuration may allow proving that leaked content stream was not illegally captured from the network.
• the encrypted VPN tunnel may be not necessary since the local network is less exposed to eavesdropping than the global network.
• the remote multimedia reception device RMRD When the remote multimedia reception device RMRD is connected to the network router RT, respectively to the network device D, the obtained IP address together with the unique address UA of the network device D is transmitted by said network device D to the server of the conditional access system CAS after a user login with a user name and password.
• the remote multimed ia reception device RMRD receives the descrambled and watermarked audio / video content stream in a similar way than the multimedia reception device MRD in the local mode.
• a remote access to other devices connected to the network router is also possible.
• content stored on a hard disk HD, or in a personal computer PC is thus accessible whatever the location of the remote multimedia reception device RMRD.
• the audio / video content stream is transmitted to the multimedia reception device MRD or to the remote multimedia reception device RMRD via the network by using preferably a protocol named Real Time Streaming Protocol (RTSP) or Secure Real Time Streaming Protocol (RTSPS), which is a network control protocol designed for use in entertainment and communications systems to control streaming media servers, i.e. the network router with the dongle of the present invention.
• RTSP Real Time Streaming Protocol
• RTSPS Secure Real Time Streaming Protocol
• a client of a media server i.e. the remote multimedia reception device RMRD is configured to issue commands as a video player / recorder, such as play, pause, fast forward, rewind, to facilitate real-time control of playback of the content of the server, i.e. the network router RT with the dongle D.
• commands such as play, pause, fast forward, rewind
• the server i.e. the network router RT with the dongle D.
• media players like Zattoo, VLC, Real Player, Flash Player, Windows media players, etc. use the RTSP protocol.

Landscapes

• Engineering & Computer Science (AREA)
• Signal Processing (AREA)
• Multimedia (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Priority Applications (7)

Applications Claiming Priority (2)

Publications (1)

Family

ID=46062669

Family Applications (1)

Country Status (8)

Cited By (7)

Families Citing this family (12)

Citations (6)

Family Cites Families (52)

• 2012
  • 2012-04-19 MX MX2013012074A patent/MX337186B/es active IP Right Grant
  • 2012-04-19 BR BR112013026389-0A patent/BR112013026389B1/pt active IP Right Grant
  • 2012-04-19 US US14/112,450 patent/US9742736B2/en active Active
  • 2012-04-19 CA CA2832522A patent/CA2832522C/en active Active
  • 2012-04-19 WO PCT/IB2012/051968 patent/WO2012143880A1/en active Application Filing
  • 2012-04-19 CN CN201280019398.2A patent/CN103493497B/zh active Active
  • 2012-04-19 EP EP12720638.1A patent/EP2700238B1/en active Active
• 2013
  • 2013-09-23 ZA ZA2013/07138A patent/ZA201307138B/en unknown

Patent Citations (6)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events